What is the CVSS score of CVE-2026-8280?

CVE-2026-8280 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-8280?

Yes, a patch is available for CVE-2026-8280. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-8280

EUVD-2026-30243 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-05-14 cve@gitlab.com

GHSA-fqvq-p2gc-c297

Denial Of Service Gitlab

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:09 vuln.today

Patch available

May 14, 2026 - 07:16 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to cause denial of service through excessive memory consumption due to improper input validation.

AnalysisAI

GitLab CE and EE are vulnerable to authenticated denial of service through excessive memory consumption, affecting all installations from version 8.3 up to the patched releases. An authenticated user with minimal privileges can submit maliciously crafted input that bypasses proper validation, causing the server to allocate memory without adequate bounds until service degradation or outage occurs. EPSS is low at 0.06% (18th percentile), no active exploitation is confirmed (CISA KEV absent, SSVC exploitation status: none), and a vendor patch was released on May 13, 2026.

Technical ContextAI

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling), a class of vulnerability where user-supplied input is processed without enforcing constraints on the resources consumed - in this case, server-side memory. GitLab's application layer fails to reject or cap input that triggers unbounded memory allocation, allowing an attacker to exhaust available heap or process memory. The affected products are confirmed by CPE strings cpe:2.3:a:gitlab:gitlab covering both the Community Edition (CE) and Enterprise Edition (EE) across a broad version range starting from 8.3. This vulnerability is inherently tied to GitLab's server-side input processing pipeline, though the specific feature or endpoint triggering the allocation is not identified in the public disclosure; the linked GitLab work item (gitlab.com/gitlab-org/gitlab/-/work_items/579035) and HackerOne report 3329085 may contain additional technical detail for authorized researchers.

RemediationAI

Vendor-released patches are available in GitLab 18.9.7, 18.10.6, and 18.11.3, published May 13, 2026 via https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. Administrators should upgrade to the appropriate patched version for their release branch as the primary remediation. For organizations unable to patch immediately, compensating controls should focus on limiting the privilege surface: restricting user registration (disable open self-registration if not required) reduces the pool of accounts that could exploit this; rate-limiting or WAF rules applied at the reverse proxy layer targeting anomalously large or repeated requests may reduce exploitation effectiveness, though the specific triggering endpoint is not publicly confirmed. Monitoring for memory pressure or unusual resource consumption spikes on GitLab application nodes can serve as a detection mechanism. Note that no workaround fully substitutes for patching given the broad affected version range.